Network traffic can be prevented from entering a protected network. An alert can be received that can be triggered by network traffic that matches at least one signature that is associated with undesired network behavior. A source of the network traffic that triggered the alert can be determined, and network traffic that originates from the source can be blocked. Blocking the source can include assigning a determination to the alert. It can then be determined whether network traffic from the source should be blocked based on the determination. The source can then be provided to the protected network such that a network device coupled to the protected network can be configured to block network traffic that originates from the source.
Legal claims defining the scope of protection. Each claim is shown in both the original legal language and a plain English translation.
1. A method comprising: receiving at a network protection system an alert from an intrusion detection system associated with a protected network, wherein the alert is triggered by network traffic that is evaluated by the intrusion detection system and that is determined to match a signature that is associated with undesired network behavior; determining a source of the network traffic that triggered the alert; grouping at the network protection system the alert into an alert group; assigning a determination to the alert group, the determination indicating a threat level associated with the alert group; generating an entry in an undesired source database based on the alert group, the entry including a first Internet Protocol (IP) address associated with the alert; and providing the undesired source database to the intrusion detection system, such that the intrusion detection system is configured to block network traffic that originates from the first IP address.
A network protection system receives alerts from an intrusion detection system (IDS) when network traffic matches signatures of unwanted activity. The system identifies the source IP address of the traffic that triggered the alert. It then groups the alert and assigns a threat level. Based on this threat level, the system creates an entry in a database of undesired sources, including the source IP address. This database is then shared with the IDS, which configures itself to block any further traffic originating from that IP address, preventing unwanted network traffic from reaching the protected network.
2. The method of claim 1 , wherein generating the entry further comprises: determining that a second IP address associated with a second alert is a spoofed IP address; and disregarding the second IP address from the undesired source database in response to determining that the second IP address is a spoofed IP address.
The method described above, where a network protection system blocks unwanted traffic, also handles spoofed IP addresses. When creating the database entry of undesired sources, the system checks if a second alert's IP address is spoofed. If it determines the IP is spoofed, that second IP address is excluded from the database. This prevents the system from incorrectly blocking traffic from legitimate sources due to spoofed IPs triggering alerts.
3. The method of claim 1 , wherein generating the entry further comprises: determining that traffic associated with a second alert is a Universal Datagram Protocol (UDP) traffic; and disregarding a second IP address associated with the second alert in response to determining that the traffic UDP traffic.
The method described above, where a network protection system blocks unwanted traffic, also handles UDP traffic specifically. When creating the database entry of undesired sources, the system identifies if traffic associated with a second alert is UDP. If it determines the traffic is UDP, the IP address from that second alert is excluded from the database. This can be useful in cases where UDP traffic frequently triggers false positives or is less reliably indicative of malicious activity.
4. The method of claim 1 , wherein generating the entry further comprises: determining that the first IP address is associated with a geolocation, wherein the first IP address is included in the entry in response to determining that the first IP address is associated with the geolocation.
The method described above, where a network protection system blocks unwanted traffic, also considers geolocation. When creating the database entry of undesired sources, the system determines the geolocation associated with the source IP address. If a geolocation is found, the source IP is included in the database entry, enabling geographically-aware blocking. This allows the system to block traffic originating from specific geographic regions deemed high-risk.
5. The method of claim 1 , wherein generating the entry further comprises: determining that the alert group includes more than a predetermined number of reconnaissance activities; and determining that the first IP address is associated with a reconnaissance activity, wherein the first IP address in included in the entry in response to determining that the alert group includes more than the predetermined number of reconnaissance activities.
The method described above, where a network protection system blocks unwanted traffic, also considers reconnaissance activity. When creating the database entry of undesired sources, the system checks if the alert group contains more than a defined number of reconnaissance attempts. If this number is exceeded and the source IP address is associated with reconnaissance activity, the source IP is included in the database. This approach prioritizes blocking sources actively probing the network for vulnerabilities.
6. The method of claim 1 , wherein generating the entry further comprises: determining that the alert group includes more than a predetermined number of alerts from matched signatures received by a predetermined number of target devices in a predetermined period of time.
The method described above, where a network protection system blocks unwanted traffic, also considers the frequency and scope of alerts. When creating the database entry of undesired sources, the system checks if the alert group contains more than a specified number of alerts, triggered by matched signatures, and received by a specified number of target devices within a defined time period. This ensures that the system responds to widespread or intense attacks impacting multiple targets simultaneously.
7. The method of claim 6 , further comprising: determining that the generating of the entry resulted in an excess number of entries in the undesired source database; and increasing at least one of the predetermined number of alerts, the predetermined number of target devices, and the predetermined period of time.
Building on the previous description of a network protection system that blocks unwanted traffic based on alert frequency and scope, this extension dynamically adjusts blocking sensitivity. If creating undesired source database entries results in too many entries, the system increases the thresholds: the number of alerts needed, the number of targeted devices, or the observation time period. This reduces the system's sensitivity, preventing over-blocking when under attack.
8. The method of claim 6 , further comprising: determining that the undesired source database includes an insufficient number of entries; and decreasing at least one of the predetermined number of alerts, the predetermined number of target devices, and the predetermined period of time.
Building on the description of a network protection system that blocks unwanted traffic based on alert frequency and scope, this extension dynamically adjusts blocking sensitivity in the opposite direction. If the undesired source database contains too few entries, the system decreases the thresholds: the number of alerts needed, the number of targeted devices, or the observation time period. This increases the system's sensitivity, ensuring more aggressive blocking when attack volume is low.
9. A non-transitory computer-readable medium encoded with computer-executable instructions for performing a method, the method comprising: receiving at a network protection system an alert from an intrusion detection system associated with a protected network, wherein the alert is triggered by network traffic that is evaluated by the intrusion detection system and that is determined to match a signature that is associated with undesired network behavior; determining a source of the network traffic that triggered the alert; grouping at the network protection system the alert into an alert group; assigning a determination to the alert group, the determination indicating a threat level associated with the alert group; generating an entry in an undesired source database based on the alert group, the entry including a first Internet Protocol (IP) address associated with the alert; and providing the undesired source database to the intrusion detection system, such that the intrusion detection system is configured to block network traffic that originates from the first IP address.
A non-transitory computer-readable medium contains instructions that, when executed, cause a network protection system to receive alerts from an intrusion detection system (IDS) when network traffic matches signatures of unwanted activity. The instructions cause the system to identify the source IP address of the traffic that triggered the alert, group the alert, and assign a threat level. Based on this threat level, the instructions create an entry in a database of undesired sources, including the source IP address. This database is then shared with the IDS, which configures itself to block any further traffic originating from that IP address.
10. The computer-readable medium of claim 9 , wherein, in generating the entry, the method further comprises: determining that a second IP address associated with a second alert is a spoofed IP address; and disregarding the second IP address from the undesired source database in response to determining that the second IP address is a spoofed IP address.
The computer-readable medium described above, concerning a network protection system that blocks unwanted traffic, includes instructions to handle spoofed IP addresses. When creating the database entry of undesired sources, the instructions check if a second alert's IP address is spoofed. If it determines the IP is spoofed, that second IP address is excluded from the database.
11. The computer-readable medium of claim 9 , wherein, in generating the entry, the method further comprises: determining that traffic associated with a second alert is a Universal Datagram Protocol (UDP) traffic; and disregarding a second IP address associated with the second alert in response to determining that the traffic UDP traffic.
The computer-readable medium described above, concerning a network protection system that blocks unwanted traffic, includes instructions to handle UDP traffic. When creating the database entry of undesired sources, the instructions identify if traffic associated with a second alert is UDP. If it determines the traffic is UDP, the IP address from that second alert is excluded from the database.
12. The computer-readable medium of claim 9 , wherein, in generating the entry, the method further comprises: determining that the first IP address is associated with a geolocation, wherein the first IP address is included in the entry in response to determining that the first IP address is associated with the geolocation.
The computer-readable medium described above, concerning a network protection system that blocks unwanted traffic, includes instructions to consider geolocation. When creating the database entry of undesired sources, the instructions determine the geolocation associated with the source IP address. If a geolocation is found, the source IP is included in the database entry.
13. The computer-readable medium of claim 9 , wherein, in generating the entry, the method further comprises: determining that the alert group includes more than a predetermined number of reconnaissance activities; and determining that the first IP address is associated with a reconnaissance activity, wherein the first IP address in included in the entry in response to determining that the alert group includes more than the predetermined number of reconnaissance activities.
The computer-readable medium described above, concerning a network protection system that blocks unwanted traffic, includes instructions to consider reconnaissance activity. When creating the database entry of undesired sources, the instructions check if the alert group contains more than a defined number of reconnaissance attempts. If this number is exceeded and the source IP address is associated with reconnaissance activity, the source IP is included in the database.
14. The computer-readable medium of claim 9 , wherein, in generating the entry, the method further comprises: determining that the alert group includes more than a predetermined number of alerts from matched signatures received by a predetermined number of target devices in a predetermined period of time.
The computer-readable medium described above, concerning a network protection system that blocks unwanted traffic, includes instructions to consider the frequency and scope of alerts. When creating the database entry of undesired sources, the instructions check if the alert group contains more than a specified number of alerts, triggered by matched signatures, and received by a specified number of target devices within a defined time period.
15. The computer-readable medium of claim 14 , the method further comprising: determining that the generating of the entry resulted in an excess number of entries in the undesired source database; and increasing at least one of the predetermined number of alerts, the predetermined number of target devices, and the predetermined period of time.
Building on the previous description of a computer-readable medium for a network protection system that blocks unwanted traffic based on alert frequency and scope, the instructions also dynamically adjust blocking sensitivity. If creating undesired source database entries results in too many entries, the instructions increase the thresholds: the number of alerts needed, the number of targeted devices, or the observation time period.
16. The computer-readable medium of claim 14 , the method further comprising: determining that the undesired source database includes an insufficient number of entries; and decreasing at least one of the predetermined number of alerts, the predetermined number of target devices, and the predetermined period of time.
Building on the description of a computer-readable medium for a network protection system that blocks unwanted traffic based on alert frequency and scope, the instructions also dynamically adjust blocking sensitivity. If the undesired source database contains too few entries, the instructions decrease the thresholds: the number of alerts needed, the number of targeted devices, or the observation time period.
Cooperative Patent Classification codes for this invention. Click any code to explore related patents in that topic.
April 29, 2016
April 18, 2017
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.